Skip to content

Commit ed73650

Browse files
committed
Prevent passing in of monitor type that could contain invalid characters https://sourceforge.net/tracker/index.php?func=detail&aid=3542038&group_id=17457&atid=117457#
1 parent 5295b8a commit ed73650

File tree

3 files changed

+3
-0
lines changed

3 files changed

+3
-0
lines changed

Diff for: status/edit_mon.cgi

+1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ $access{'edit'} || &error($text{'mon_ecannot'});
99
@handlers = &list_handlers();
1010
if ($in{'type'}) {
1111
# Create a new monitor
12+
$in{'type'} =~ /^[a-zA-Z0-9\_\-\.]+$/ || &error($text{'mon_etype'});
1213
$type = $in{'type'};
1314
$title = $text{'mon_create'};
1415
if ($in{'clone'}) {

Diff for: status/lang/en

+1
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ mon_eremote2=Webmin server $1 could not be contacted : $2
104104
mon_estatus=Webmin server $1 does not have the System and Server Status module
105105
mon_ecannot=You are not allowed to edit monitors
106106
mon_ertype=This monitor type is not available on $1
107+
mon_etype=Invalid monitor type name
107108
mon_runon=Run commands on
108109
mon_runon0=This server
109110
mon_runon1=The remote host

Diff for: status/save_mon.cgi

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ require './status-lib.pl';
66
$access{'edit'} || &error($text{'mon_ecannot'});
77
&ReadParse();
88
if ($in{'type'}) {
9+
$in{'type'} =~ /^[a-zA-Z0-9\_\-\.]+$/ || &error($text{'mon_etype'});
910
$serv->{'type'} = $in{'type'};
1011
$serv->{'id'} = time();
1112
}

0 commit comments

Comments
 (0)